The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute various shell commands for file management and symlink resolution, including readlink, realpath, test, cd, pwd, and grep. While these are necessary for the skill's primary function of file hygiene, they represent a broad set of capabilities for interacting with the local file system.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from markdown files, which could be crafted to influence agent behavior during the consolidation process.
Ingestion points: The skill reads all .md files and the MEMORY.md index file located in the project's memory directory (~/.claude/projects/<project-slug>/memory/).
Boundary markers: The skill attempts to distinguish between executable links and code examples by parsing markdown syntax (fenced and inline code blocks), but it lacks a formal schema to prevent instruction injection within prose or metadata.
Capability inventory: The agent can delete files (rm), combine file contents, modify frontmatter blocks, and update the index file.
Sanitization: Security is primarily maintained through a human-in-the-loop approval process (Phase 3), where all proposed deletions or modifications must be reviewed. The instructions also provide specific guidance on avoiding shell injection when handling link targets, such as using the -- flag and avoiding eval.

consolidate-memory